Vulnerability · Published Jul 4, 2022 · Assigned by mitre
CVE-2022-34918
High 7.8
In plain English
A high-severity security flaw in the bpftool package (AlmaLinux). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 5.5% (higher than 93% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)7.8High
Exploit odds (30 days)5.5%top 7.2% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack tooling2Metasploit, Public PoC
Official description
An issue was discovered in the Linux kernel through 5.18.9. A type confusion bug in nft_set_elem_init (leading to a buffer overflow) could be used by a local attacker to escalate privileges, a different vulnerability than CVE-2022-32250. (The attacker can obtain root access, but must start with an unprivileged user namespace to obtain CAP_NET_ADMIN access.) This can be fixed in nft_setelem_parse_data in net/netfilter/nf_tables_api.c.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:9 | bpftool | 5.14.0-70.26.1.el9_0 | ALSA-2022:6610 |
| AlmaLinux:9 | kernel | 5.14.0-70.26.1.el9_0 | ALSA-2022:6610 |
| AlmaLinux:9 | kernel-abi-stablelists | 5.14.0-70.26.1.el9_0 | ALSA-2022:6610 |
| AlmaLinux:9 | kernel-core | 5.14.0-70.26.1.el9_0 | ALSA-2022:6610 |
| AlmaLinux:9 | kernel-cross-headers | 5.14.0-70.26.1.el9_0 | ALSA-2022:6610 |
| AlmaLinux:9 | kernel-debug | 5.14.0-70.26.1.el9_0 | ALSA-2022:6610 |
| AlmaLinux:9 | kernel-debug-core | 5.14.0-70.26.1.el9_0 | ALSA-2022:6610 |
| AlmaLinux:9 | kernel-debug-devel | 5.14.0-70.26.1.el9_0 | ALSA-2022:6610 |
| AlmaLinux:9 | kernel-debug-devel-matched | 5.14.0-70.26.1.el9_0 | ALSA-2022:6610 |
| AlmaLinux:9 | kernel-debug-modules | 5.14.0-70.26.1.el9_0 | ALSA-2022:6610 |
| AlmaLinux:9 | kernel-debug-modules-extra | 5.14.0-70.26.1.el9_0 | ALSA-2022:6610 |
| AlmaLinux:9 | kernel-devel | 5.14.0-70.26.1.el9_0 | ALSA-2022:6610 |
| AlmaLinux:9 | kernel-devel-matched | 5.14.0-70.26.1.el9_0 | ALSA-2022:6610 |
| AlmaLinux:9 | kernel-doc | 5.14.0-70.26.1.el9_0 | ALSA-2022:6610 |
| AlmaLinux:9 | kernel-modules | 5.14.0-70.26.1.el9_0 | ALSA-2022:6610 |
| AlmaLinux:9 | kernel-modules-extra | 5.14.0-70.26.1.el9_0 | ALSA-2022:6610 |
| AlmaLinux:9 | kernel-rt | 5.14.0-70.26.1.rt21.98.el9_0 | ALSA-2022:6582 |
| AlmaLinux:9 | kernel-rt-core | 5.14.0-70.26.1.rt21.98.el9_0 | ALSA-2022:6582 |
| AlmaLinux:9 | kernel-rt-debug | 5.14.0-70.26.1.rt21.98.el9_0 | ALSA-2022:6582 |
| AlmaLinux:9 | kernel-rt-debug-core | 5.14.0-70.26.1.rt21.98.el9_0 | ALSA-2022:6582 |
| AlmaLinux:9 | kernel-rt-debug-devel | 5.14.0-70.26.1.rt21.98.el9_0 | ALSA-2022:6582 |
| AlmaLinux:9 | kernel-rt-debug-kvm | 5.14.0-70.26.1.rt21.98.el9_0 | ALSA-2022:6582 |
| AlmaLinux:9 | kernel-rt-debug-modules | 5.14.0-70.26.1.rt21.98.el9_0 | ALSA-2022:6582 |
| AlmaLinux:9 | kernel-rt-debug-modules-extra | 5.14.0-70.26.1.rt21.98.el9_0 | ALSA-2022:6582 |
| AlmaLinux:9 | kernel-rt-devel | 5.14.0-70.26.1.rt21.98.el9_0 | ALSA-2022:6582 |
| AlmaLinux:9 | kernel-rt-kvm | 5.14.0-70.26.1.rt21.98.el9_0 | ALSA-2022:6582 |
| AlmaLinux:9 | kernel-rt-modules | 5.14.0-70.26.1.rt21.98.el9_0 | ALSA-2022:6582 |
| AlmaLinux:9 | kernel-rt-modules-extra | 5.14.0-70.26.1.rt21.98.el9_0 | ALSA-2022:6582 |
| AlmaLinux:9 | kernel-tools | 5.14.0-70.26.1.el9_0 | ALSA-2022:6610 |
| AlmaLinux:9 | kernel-tools-libs | 5.14.0-70.26.1.el9_0 | ALSA-2022:6610 |
| AlmaLinux:9 | kernel-tools-libs-devel | 5.14.0-70.26.1.el9_0 | ALSA-2022:6610 |
| AlmaLinux:9 | kernel-zfcpdump | 5.14.0-70.26.1.el9_0 | ALSA-2022:6610 |
| AlmaLinux:9 | kernel-zfcpdump-core | 5.14.0-70.26.1.el9_0 | ALSA-2022:6610 |
| AlmaLinux:9 | kernel-zfcpdump-devel | 5.14.0-70.26.1.el9_0 | ALSA-2022:6610 |
| AlmaLinux:9 | kernel-zfcpdump-devel-matched | 5.14.0-70.26.1.el9_0 | ALSA-2022:6610 |
| AlmaLinux:9 | kernel-zfcpdump-modules | 5.14.0-70.26.1.el9_0 | ALSA-2022:6610 |
| AlmaLinux:9 | kernel-zfcpdump-modules-extra | 5.14.0-70.26.1.el9_0 | ALSA-2022:6610 |
| AlmaLinux:9 | perf | 5.14.0-70.26.1.el9_0 | ALSA-2022:6610 |
| AlmaLinux:9 | python3-perf | 5.14.0-70.26.1.el9_0 | ALSA-2022:6610 |
| Debian:12 | linux | 5.18.14-1 | DEBIAN-CVE-2022-34918 |
| Debian:13 | linux | 5.18.14-1 | DEBIAN-CVE-2022-34918 |
| Debian:14 | linux | 5.18.14-1 | DEBIAN-CVE-2022-34918 |
| Ubuntu:22.04:LTS | linux | 5.15.0-43.46 | UBUNTU-CVE-2022-34918 |
| Ubuntu:22.04:LTS | linux | 5.15.0-43.46 | USN-5544-1 |
| Ubuntu:22.04:LTS | linux-aws | 5.15.0-1017.21 | USN-5566-1 |
| Ubuntu:22.04:LTS | linux-aws | 5.15.0-1017.21 | UBUNTU-CVE-2022-34918 |
| Ubuntu:22.04:LTS | linux-azure | 5.15.0-1017.20 | UBUNTU-CVE-2022-34918 |
| Ubuntu:22.04:LTS | linux-azure | 5.15.0-1017.20 | USN-5566-1 |
| Ubuntu:22.04:LTS | linux-gcp | 5.15.0-1016.21 | USN-5566-1 |
| Ubuntu:22.04:LTS | linux-gcp | 5.15.0-1016.21 | UBUNTU-CVE-2022-34918 |
| Ubuntu:22.04:LTS | linux-gke | 5.15.0-1014.17 | UBUNTU-CVE-2022-34918 |
| Ubuntu:22.04:LTS | linux-gke | 5.15.0-1014.17 | USN-5566-1 |
| Ubuntu:22.04:LTS | linux-gkeop | 5.15.0-1002.4 | UBUNTU-CVE-2022-34918 |
| Ubuntu:22.04:LTS | linux-ibm | 5.15.0-1012.14 | USN-5566-1 |
| Ubuntu:22.04:LTS | linux-ibm | 5.15.0-1012.14 | UBUNTU-CVE-2022-34918 |
| Ubuntu:22.04:LTS | linux-intel-iot-realtime | no fix listed | UBUNTU-CVE-2022-34918 |
| Ubuntu:22.04:LTS | linux-intel-iotg | 5.15.0-1013.17 | USN-5564-1 |
| Ubuntu:22.04:LTS | linux-intel-iotg | 5.15.0-1013.17 | UBUNTU-CVE-2022-34918 |
| Ubuntu:22.04:LTS | linux-kvm | 5.15.0-1016.19 | USN-5566-1 |
| Ubuntu:22.04:LTS | linux-kvm | 5.15.0-1016.19 | UBUNTU-CVE-2022-34918 |
| Ubuntu:22.04:LTS | linux-lowlatency | 5.15.0-43.46 | USN-5544-1 |
| Ubuntu:22.04:LTS | linux-lowlatency | 5.15.0-43.46 | UBUNTU-CVE-2022-34918 |
| Ubuntu:22.04:LTS | linux-oem-5.17 | 5.17.0-1014.15 | USN-5545-1 |
| Ubuntu:22.04:LTS | linux-oem-5.17 | 5.17.0-1014.15 | UBUNTU-CVE-2022-34918 |
| Ubuntu:22.04:LTS | linux-oracle | 5.15.0-1016.20 | USN-5566-1 |
| Ubuntu:22.04:LTS | linux-oracle | 5.15.0-1016.20 | UBUNTU-CVE-2022-34918 |
| Ubuntu:22.04:LTS | linux-raspi | 5.15.0-1013.15 | UBUNTU-CVE-2022-34918 |
| Ubuntu:22.04:LTS | linux-raspi | 5.15.0-1013.15 | USN-5566-1 |
| Ubuntu:24.04:LTS | linux-raspi-realtime | no fix listed | UBUNTU-CVE-2022-34918 |
| Ubuntu:22.04:LTS | linux-realtime | no fix listed | UBUNTU-CVE-2022-34918 |
| Ubuntu:22.04:LTS | linux-riscv | 5.15.0-1016.18 | UBUNTU-CVE-2022-34918 |
Affected products (as reported)
References
- https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=7e6bc1f6cabcd30aba0b11219d8e01b952eacbb6 x_refsource_MISC
- https://lore.kernel.org/netfilter-devel/cd9428b6-7ffb-dd22-d949-d86f4869f452%40randorisec.fr/T/#u x_refsource_MISC
- https://www.openwall.com/lists/oss-security/2022/07/02/3 x_refsource_MISC
- [oss-security] 20220705 Re: Linux kernel: Netfilter heap buffer overflow in nft_set_elem_init mailing-list, x_refsource_MLIST
- https://www.randorisec.fr/crack-linux-firewall/ x_refsource_MISC
- DSA-5191 vendor-advisory, x_refsource_DEBIAN
- [oss-security] 20220806 Re: Linux kernel: Netfilter heap buffer overflow in nft_set_elem_init mailing-list, x_refsource_MLIST
- https://security.netapp.com/advisory/ntap-20220826-0004/ x_refsource_CONFIRM
- http://packetstormsecurity.com/files/168191/Kernel-Live-Patch-Security-Notice-LSN-0089-1.html x_refsource_MISC
- http://packetstormsecurity.com/files/168543/Netfilter-nft_set_elem_init-Heap-Overflow-Privilege-Escalation.html x_refsource_MISC
- https://cert-portal.siemens.com/productcert/html/ssa-794697.html
- https://cert-portal.siemens.com/productcert/html/ssa-806742.html